feat: create named API keys

[tony8713]

Summary

Makes it possible to create a named API key directly from the Snapshot UI (snapshot-labs/sx-monorepo#2111).

The UI's createApiKey helper posts { method: "whitelist", params: { name, address } } to keycard with no secret header and expects result.key back. The whitelist method already accepts { name, address } and returns a generated { key } (added in #79), but authChecker rejected it because only generate_key was exempt from the apps secret. This PR adds whitelist to the public methods so the browser call reaches the method.

Changes

• src/helpers/auth.ts: allow whitelist (alongside generate_key) without the apps secret.
• test/e2e/whitelist.test.ts: assert the returned key length, add a "no secret" case, and scope cleanupDb to this suite's NAME so leftover rows no longer leak between tests (this was the source of the flaky 409).
• README.md: document whitelist as a public, UI-callable method returning a key.

UI -> keycard contract (from sx-monorepo#2111)

POST https://keycard.snapshot.org/
{ "jsonrpc": "2.0", "method": "whitelist", "params": { "name": "<name>", "address": "<wallet>" }, "id": null }
-> { "result": { "success": true, "key": "<64-char key>" } }

Test plan

• yarn lint and yarn typecheck pass.
• yarn test:e2e passes 19/19, stable across 3 runs (incl. the previously flaky already whitelisted -> 409).

For reviewers to decide

1. Auth model. This endpoint now whitelists any address with no proof of wallet ownership and no apps secret. generate_key proves ownership via a signed message; whitelist does not. If we want ownership proof for the UI flow, the UI (sx-monorepo#2111) would need to sign and we'd verify here instead of (or in addition to) opening it up.
2. One key per owner. keys has PRIMARY KEY (owner), so a second whitelist for the same wallet returns 409 Address already whitelisted. The UI lists multiple keys per wallet (metadata in localStorage), but the backend currently allows only one. Supporting multiple named keys per wallet needs a schema change (surrogate PK) and reworking updateKey/createNewKey to target a single row; kept out of this PR as it touches the existing generate_key flow.

Closes the backend gap for snapshot-labs/sx-monorepo#2111.

🤖 Generated with Claude Code